104.236.69.29📋 Copy

# IP Intelligence Briefing: 104.236.69.29/32

Briefing Date: 2026-06-16

Intel Source: IPDebrief Threat Intelligence Platform

Classification: SOC Actionable Intelligence

---

## Executive Summary

IP address 104.236.69.29 is a DigitalOcean cloud infrastructure endpoint operating as a web server. Current risk assessment indicates Moderate Risk (55/100) with no active threat indicators. The IP resolves to Cloudways hosting infrastructure and exhibits standard web server characteristics. Monitoring is recommended due to elevated risk score, though blocking is not currently justified without corroborating threat signals.

---

## Infrastructure Profile

---

## Service Exposure

The endpoint exposes standard web services with SSH access:

Server Stack: nginx (TLS 1.3, TLS_AES_256_GCM_SHA384 cipher suite)

TLS Certificate: Sectigo Public Server Authentication CA DV R36, subject: *.cloudwaysapps.com

---

## DNS & Hostname Resolution

• PTR Hostname: 1610509.cloudwaysapps.com
• Forward Resolution: 1610509.cloudwaysapps.com
• Associated Domain: cloudwaysapps.com (Cloudways application hosting platform)
• Forward Confirmation: False
• Email Authentication: SPF/DMARC not configured

---

## Threat Indicators Assessment

• Known Campaigns: None
• Threat Feeds: None
• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Abuse Confidence Score: Not applicable
• DNSBL Listed: 3 of 8 total lists (operator score: 0.1304 - Minimal)

---

## Network Neighborhood Analysis

Subnet: 104.236.69.0/24

• Abuse Density: 0%
• Classification: Clean
• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 0

No neighboring IPs in the /24 subnet show threat indicators.

---

## Control Plane Stability

• BGP Prefix: 104.236.64.0/18
• Route Stability: False
• RPKI State: Not available
• IRR Consistency: Not available
• Route Changes (30d): 0

---

## Historical Observations

Signal history indicates stable infrastructure behavior:

• HTTP/2 responses with 144ms TTFB
• TLS 1.3 implementation with strong cipher suites
• No observed ownership changes
• No persistent malicious activity detected
• Consistent web server fingerprint (nginx)

---

## Relationship Graph

• Network Association: DIGITALOCEAN-104-236-0-0 (multiple entries)
• DNS Associations: 1610509.cloudwaysapps.com (6 associations)

---

## Recommended Actions

Monitoring (High Priority)

• Increase logging verbosity and review recent activity from this IP
• Monitor for behavioral changes given elevated risk score

Firewall Rules (Prepared)

```bash

# iptables

iptables -A INPUT -s 104.236.69.29 -j DROP

# nftables

nft add rule inet filter input ip saddr 104.236.69.29 drop

# nginx

deny 104.236.69.29;

# pfSense

104.236.69.29/32

# Cloudflare WAF

ip.src eq 104.236.69.29 → Block

# AWS WAF

Addresses: 104.236.69.29/32

```

---

## Analyst Notes

Key Observation: Risk score of 55/100 is elevated but lacks corroborating threat indicators. The IP is associated with Cloudways hosting (a legitimate PaaS provider), and neighborhood analysis shows a clean subnet with no abuse density.

Recommended Approach: Maintain monitoring without immediate blocking. The elevated risk score may reflect general cloud infrastructure baseline risk rather than active malicious activity. Implement additional validation if threat intelligence correlates with known campaigns or if behavioral anomalies emerge.

Action Priority: Monitor (High) — Block only if corroborated by additional threat signals.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.